Microsoft Patches Path Traversal Flaw in NLWeb AI Agent Platform
Researchers discovered a path traversal vulnerability in Microsoft's NLWeb AI agent platform that allowed remote access to sensitive files and API keys. Microsoft patched the flaw on July 1, 2025, but did not issue a formal CVE classification, and the vulnerability potentially affected deployed customers including Shopify, Eventbrite, and TripAdvisor.
What happened
Researchers Aonan Guan and Lei Wang discovered a path traversal vulnerability in Microsoft's NLWeb platform that allowed remote users to access sensitive files by manipulating file paths, such as through malformed URLs.
The flaw could expose system configuration files and API keys for large language models like OpenAI's GPT-4 and Google's Gemini. The researchers reported the vulnerability to Microsoft on May 28, 2025, and Microsoft issued a fix on July 1, 2025, by updating the open-source repository.
Reported impact
Guan argued that exposing LLM API keys was 'catastrophic,' as attackers could steal an AI agent's 'ability to think, reason, and act,' potentially leading to massive financial loss or creation of a malicious clone.
The vulnerability affected customers who had already deployed NLWeb, including Shopify, Eventbrite, and TripAdvisor.
Index analysis
This is a classic path traversal vulnerability, a common and easily exploitable security flaw that should have been caught during development and testing.
The vulnerability is particularly concerning for AI systems because compromised API keys could give attackers direct control over the capabilities and behavior of deployed AI agents.
Governance controls
Microsoft did not issue a CVE (Common Vulnerabilities and Exposures) classification for the flaw, which is industry standard for tracking security vulnerabilities. Guan and Wang pushed Microsoft to issue a CVE to alert more people to the fix.
Microsoft stated that customers using NLWeb 'are automatically protected' after updating the repository, though researchers noted that users must actively pull the new build version to eliminate the flaw.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.